Equipment for hemodialysis has become widely available in recent years. Particularly suitable systems are described in U.S. Pat. Nos. 4,122,010; 4,158,034; 4,293,409; 4,194,974; 4,191,359; and 4,536,201, the disclosures of which are incorporated herein by reference thereto. Additional aspects of hemodialysis equipment and methods are also described in British Pat. No. 2,003,274, and in co-pending commonly assigned U.S. patent application Ser. No. 531,277, the disclosures of which are also incorporated herein by reference thereto.
Although the hemodialysis equipment and methods disclosed in the aforementioned patents and applications provide effective treatment modalities, there has been a need for still further improvement. There have been particularly acute needs for improvements in the control panels or interfaces between the machine operator and the machine. Hemodialysis processes typically entail the control of numerous operating parameters, such as, e.g., various fluid temperatures, ultrafiltration rates, ultrafiltrate volumes, transmembrane pressures or pressure differentials across the dialysis membrane itself, and various different fluid flows. The control of blood flow to and from the machine, venous pressure, arterial pressure and blood temperature may also be required. Each of these parameters may be regulated according to one or more control constants. In the simplest form of said regulation, the system may merely monitor deviations of the actual value of the parameter in question from a set point or desired value and undertake corrective action. Typically, however, upper and lower limits are also provided for some or all of these parameters as an additional safety factor. Thus, the system may then monitor the actual value of the parameter in question and generate an alarm signal, where the actual value is outside the range between the upper and lower alarm limits Accordingly, three different values of the three different control constants--lower limit, set point and upper limit--must be supplied to the control system for each parameter where this scheme is employed.
The machine operator must therefore enter a large number of different values or different control constants into a system to set the system for desired modes of operation. In apparatus of this nature which has been utilized heretofore, the control panel typically has incorporated a separate, continuously movable maneuvering element such as a control knob or slide for each different control constant to be entered. Arrangements of this nature require a great number cf knobs and the like on the control panel, and hence make the control panel confusing and difficult to use. The operator may encounter difficulties in determining which knob or maneuvering element should be adjusted to alter a given function of the system. These difficulties are compounded where the knobs or other control elements are dispersed on the panel, so that a given knob may be remote from the gauge or indicator for the parameter associated with that knob. Such confusion can be inconvenient for the operator and can also present a safety hazard if the wrong control constant is adjusted by mistake.
Moreover, a further safety hazard can be created if the operator enters the wrong value for a control constant. The operator may mistakenly set a value for an upper alarm limit on a parameter which is orders of magnitude too high, and hence may effectively disable the alarm function of the system. Manifestly, such an error can create a safety hazard, inasmuch as the alarm would not operate even though a potentially dangerous condition exists.
Where the system incorporates digital microprocessors for comparing the actual values of the various parameters with the associated control constants and initiating appropriate control or alarm action, it is most desirable to use at least two microprocessors including a supervisory microprocessor and a control microprocessor, each microprocessor having a storage register associated therewith. The control constants are stored in the registers associated with each of the microprocessors. The control microprocessor may adjust operation of the system based on a comparison of actual measured values for the various parameters with the appropriate set input value, whereas the supervisory microprocessor compares the actual measured values with the upper and lower limit values and generates an alarm if any parameter varies beyond the essential upper or lower limit. The two microprocessors provide redundancy and hence increased safety.
There has been a problem heretofore in the operation of redundant microprocessor systems of this nature, where such systems are associated with a control panel having analog devices such as knobs or other movable maneuvering elements for setting the values of the control constants. Typically, the maneuvering elements are associated with analog electrical devices such as potentiometers, so that the setting of each knob or other maneuvering element must be interpreted and converted into a digital value of the associated control constant by devices such as analog-to-digital converters. Such analog devices and converters typically suffer from certain inaccuracies. These inaccuracies may result in the storage of different values for various control constants in the storage registers associated with the two microprocessors. For example, the set point values supplied to the storage register associated with the control microprocessor by the analog-to-digital converter may be above the upper limit value supplied to the storage register associated with the supervisory microprocessor even though the operator has attempted to select a set point value between the upper and lower limit values. If such a mismatch occurs, adjustment of the system by the control microprocessor will cause the actual value of the operating parameter to rise above the upper limit applied by the supervisory microprocessor, which in turn will cause the supervisory microprocessor to continually signal an alarm condition.